Illinois Water Facility Hacking Story Debunked

By Prescott Carlson in News on Dec 2, 2011 7:20PM

U.S. terrorism fears were further stoked last month when a story broke that Russian hackers had tampered with a water pump at a downstate utility. Initial reports indicated that the facility's Supervisory Control and Data Acquisition (SCADA) system had been accessed remotely, and the pump was made to fail.

At the time, Peter Boogaard, a representative from the Department of Homeland Security said, "DHS and the FBI are gathering facts surrounding the report of a water pump failure in Springfield Illinois. At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety."

That didn't stop the panic and speculation, however, with comparisons to the infamous computer virus worm Stuxnet, along with indications that this was the start of the SCADA attack era.

But as it turns out, the utility wasn't the victim of a cyber attack but rather the result of faulty, worn out equipment.

According to Wired, the water pump had simply reached the end of its life span and burned out. And what about the evidence that the system had been accessed by a Russian IP address? That has a simple explanation, as well.

Jim Mimlitz, the owner of the company that had set up the SCADA system was asked to remotely check on some data -- while he was on vacation in Russia. Problem is, nobody at the utility knew Mimlitz was there at the time, and Mimlitz said they assumed he "would never ever have been in Russia. They shouldn’t have assumed that."

To make matters worse, even though Mimlitz's login credentials were clearly linked to the Russian IP address, he said nobody from the utility's fusion center or the Illinois State Police — which is in charge of security at the center — contacted him to see if he could add any insight to the matter. Mimlitz added that "there was also nothing in the [system] logs to indicate that the SCADA system had been turned on and off" causing it to burn out prematurely.

Illinois State Police flack Monique Bond told Wired, "We did not create the [Public Water District Cyber Intrusion] report. The report is created by a number of agencies, including the Department of Homeland Security, and we basically are just the facilitator of the report. It doesn’t originate from the [fusion center] but is distributed by the [fusion center].”

An unnamed DHS official denied Bond's statement, and was quoted as saying, "Because this was an Illinois [fusion center] product, it did not undergo such a review," and that "if the report had been DHS-approved, six different offices would have had to sign off on it."